042b638a88d3127421a72f104e7ea77e4887c687366f12763dfd4c7833688159

Analysis

max time kernel
149s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/07/2026, 00:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-24_5a8c08d7c4d12f81fff2399b3277b6b9_darkgate_elex_glassworm_remcos_stop.exe
Size 5.8MB
Sample260724-a9l35adh99
SHA256 042b638a88d3127421a72f104e7ea77e4887c687366f12763dfd4c7833688159
MD5 5a8c08d7c4d12f81fff2399b3277b6b9
SHA1 494e2f9f4601b5cefc6f9a7e3e33ce3c2bbf0dc6
SHA512 9d19e08f9ca320bb57ead320f304fff2c62dd2b5a3e2cfbc86d96d475fe1b185922a40b9821c1f36a21c966abc998a7fd447701d87ca2e7c7cbe827e6eb3e124
SSDEEP 98304:qp+K2ef+4L2+l8WssIP4ZqJDpy18frP3wbzWFimaI7dlo0A:Tef5L2+CW7cgbzWFimaI7dlG
TLSH
T149568C52BF8C817AC95A11710B2DAF2A442AFC64773465D3B2743E7EDC763C12C3A61A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware discovery persistence phishing spyware stealer

Malware Config

Signatures

A potential corporate email address has been identified in the URL: [email protected]
phishing

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Windows\CurrentVersion\Run\IDMan = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-07-24_5a8c08d7c4d12f81fff2399b3277b6b9_darkgate_elex_glassworm_remcos_stop.exe /onboot"	2026-07-24_5a8c08d7c4d12f81fff2399b3277b6b9_darkgate_elex_glassworm_remcos_stop.exe

Installs/modifies Browser Helper Object 2 TTPs 8 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}\ = "IDM Helper"	2026-07-24_5a8c08d7c4d12f81fff2399b3277b6b9_darkgate_elex_glassworm_remcos_stop.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}\NoExplorer = "1"	2026-07-24_5a8c08d7c4d12f81fff2399b3277b6b9_darkgate_elex_glassworm_remcos_stop.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects	2026-07-24_5a8c08d7c4d12f81fff2399b3277b6b9_darkgate_elex_glassworm_remcos_stop.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}	2026-07-24_5a8c08d7c4d12f81fff2399b3277b6b9_darkgate_elex_glassworm_remcos_stop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}\ = "IDM Helper"	2026-07-24_5a8c08d7c4d12f81fff2399b3277b6b9_darkgate_elex_glassworm_remcos_stop.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}\NoExplorer = "1"	2026-07-24_5a8c08d7c4d12f81fff2399b3277b6b9_darkgate_elex_glassworm_remcos_stop.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects	2026-07-24_5a8c08d7c4d12f81fff2399b3277b6b9_darkgate_elex_glassworm_remcos_stop.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}	2026-07-24_5a8c08d7c4d12f81fff2399b3277b6b9_darkgate_elex_glassworm_remcos_stop.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping7160_1809261362\data.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping7160_1809261362\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping7160_1067650216\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping7160_1067650216\typosquatting_list.pb	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-24_5a8c08d7c4d12f81fff2399b3277b6b9_darkgate_elex_glassworm_remcos_stop.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4592	msedge.exe

Checks processor information in registry 2 TTPs 21 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CurrentPatchLevel	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies Internet Explorer settings 1 TTPs 22 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Internet Explorer\MenuExt\Download with IDM	2026-07-24_5a8c08d7c4d12f81fff2399b3277b6b9_darkgate_elex_glassworm_remcos_stop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Internet Explorer\MenuExt\Download with IDM\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\IEExt.htm"	2026-07-24_5a8c08d7c4d12f81fff2399b3277b6b9_darkgate_elex_glassworm_remcos_stop.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Internet Explorer\MenuExt\Download with IDM\contexts = "243"	2026-07-24_5a8c08d7c4d12f81fff2399b3277b6b9_darkgate_elex_glassworm_remcos_stop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E0DACC63-037F-46EE-AC02-E4C7B0FBFEB4}\AppPath = "C:\\Users\\Admin\\AppData\\Local\\Temp"	2026-07-24_5a8c08d7c4d12f81fff2399b3277b6b9_darkgate_elex_glassworm_remcos_stop.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E0DACC63-037F-46EE-AC02-E4C7B0FBFEB4}\Policy = "3"	2026-07-24_5a8c08d7c4d12f81fff2399b3277b6b9_darkgate_elex_glassworm_remcos_stop.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1902485B-CE75-42C1-BA2D-57E660793D9A}\Policy = "3"	2026-07-24_5a8c08d7c4d12f81fff2399b3277b6b9_darkgate_elex_glassworm_remcos_stop.exe
Key created	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Internet Explorer\Low Rights\DragDrop\{19129CDA-AFC0-4330-99BC-C5A834F89006}	2026-07-24_5a8c08d7c4d12f81fff2399b3277b6b9_darkgate_elex_glassworm_remcos_stop.exe
Key created	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel	2026-07-24_5a8c08d7c4d12f81fff2399b3277b6b9_darkgate_elex_glassworm_remcos_stop.exe
Key created	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Internet Explorer\Low Rights	2026-07-24_5a8c08d7c4d12f81fff2399b3277b6b9_darkgate_elex_glassworm_remcos_stop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E0DACC63-037F-46EE-AC02-E4C7B0FBFEB4}\AppName = "2026-07-24_5a8c08d7c4d12f81fff2399b3277b6b9_darkgate_elex_glassworm_remcos_stop.exe"	2026-07-24_5a8c08d7c4d12f81fff2399b3277b6b9_darkgate_elex_glassworm_remcos_stop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1902485B-CE75-42C1-BA2D-57E660793D9A}\AppName = "IEMonitor.exe"	2026-07-24_5a8c08d7c4d12f81fff2399b3277b6b9_darkgate_elex_glassworm_remcos_stop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Internet Explorer\DownloadUI = "{7D11E719-FF90-479C-B0D7-96EB43EE55D7}"	2026-07-24_5a8c08d7c4d12f81fff2399b3277b6b9_darkgate_elex_glassworm_remcos_stop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\DownloadUI = "{7D11E719-FF90-479C-B0D7-96EB43EE55D7}"	2026-07-24_5a8c08d7c4d12f81fff2399b3277b6b9_darkgate_elex_glassworm_remcos_stop.exe
Key created	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote	2026-07-24_5a8c08d7c4d12f81fff2399b3277b6b9_darkgate_elex_glassworm_remcos_stop.exe
Key created	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E0DACC63-037F-46EE-AC02-E4C7B0FBFEB4}	2026-07-24_5a8c08d7c4d12f81fff2399b3277b6b9_darkgate_elex_glassworm_remcos_stop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1902485B-CE75-42C1-BA2D-57E660793D9A}\AppPath = "C:\\Users\\Admin\\AppData\\Local\\Temp"	2026-07-24_5a8c08d7c4d12f81fff2399b3277b6b9_darkgate_elex_glassworm_remcos_stop.exe
Key created	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Internet Explorer\Low Rights\DragDrop	2026-07-24_5a8c08d7c4d12f81fff2399b3277b6b9_darkgate_elex_glassworm_remcos_stop.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Internet Explorer\Low Rights\DragDrop\{19129CDA-AFC0-4330-99BC-C5A834F89006}\Policy = "3"	2026-07-24_5a8c08d7c4d12f81fff2399b3277b6b9_darkgate_elex_glassworm_remcos_stop.exe
Key created	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy	2026-07-24_5a8c08d7c4d12f81fff2399b3277b6b9_darkgate_elex_glassworm_remcos_stop.exe
Key created	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1902485B-CE75-42C1-BA2D-57E660793D9A}	2026-07-24_5a8c08d7c4d12f81fff2399b3277b6b9_darkgate_elex_glassworm_remcos_stop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Internet Explorer\Low Rights\DragDrop\{19129CDA-AFC0-4330-99BC-C5A834F89006}\AppName = "2026-07-24_5a8c08d7c4d12f81fff2399b3277b6b9_darkgate_elex_glassworm_remcos_stop.exe"	2026-07-24_5a8c08d7c4d12f81fff2399b3277b6b9_darkgate_elex_glassworm_remcos_stop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Internet Explorer\Low Rights\DragDrop\{19129CDA-AFC0-4330-99BC-C5A834F89006}\AppPath = "C:\\Users\\Admin\\AppData\\Local\\Temp"	2026-07-24_5a8c08d7c4d12f81fff2399b3277b6b9_darkgate_elex_glassworm_remcos_stop.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134293281271473904"	msedge.exe

Modifies registry class 17 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IDMan.CIDMLinkTransmitter\CLSID	2026-07-24_5a8c08d7c4d12f81fff2399b3277b6b9_darkgate_elex_glassworm_remcos_stop.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}	2026-07-24_5a8c08d7c4d12f81fff2399b3277b6b9_darkgate_elex_glassworm_remcos_stop.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\LocalServer32	2026-07-24_5a8c08d7c4d12f81fff2399b3277b6b9_darkgate_elex_glassworm_remcos_stop.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\ROTFlags = "1"	2026-07-24_5a8c08d7c4d12f81fff2399b3277b6b9_darkgate_elex_glassworm_remcos_stop.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IDMan.CIDMLinkTransmitter	2026-07-24_5a8c08d7c4d12f81fff2399b3277b6b9_darkgate_elex_glassworm_remcos_stop.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\WOW6432Node\CLSID\{07999AC3-058B-40BF-984F-69EB1E554CA7}\Model = "204"	2026-07-24_5a8c08d7c4d12f81fff2399b3277b6b9_darkgate_elex_glassworm_remcos_stop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\IDMan.CIDMLinkTransmitter\CLSID\ = "{AC746233-E9D3-49CD-862F-068F7B7CCCA4}"	2026-07-24_5a8c08d7c4d12f81fff2399b3277b6b9_darkgate_elex_glassworm_remcos_stop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\RunAs = "Interactive User"	2026-07-24_5a8c08d7c4d12f81fff2399b3277b6b9_darkgate_elex_glassworm_remcos_stop.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\WOW6432Node\CLSID\{07999AC3-058B-40BF-984F-69EB1E554CA7}\Therad = "1"	2026-07-24_5a8c08d7c4d12f81fff2399b3277b6b9_darkgate_elex_glassworm_remcos_stop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\ = "IDMan.CIDMLinkTransmitter"	2026-07-24_5a8c08d7c4d12f81fff2399b3277b6b9_darkgate_elex_glassworm_remcos_stop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\AppID = "{AC746233-E9D3-49CD-862F-068F7B7CCCA4}"	2026-07-24_5a8c08d7c4d12f81fff2399b3277b6b9_darkgate_elex_glassworm_remcos_stop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\LocalServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-07-24_5a8c08d7c4d12f81fff2399b3277b6b9_darkgate_elex_glassworm_remcos_stop.exe"	2026-07-24_5a8c08d7c4d12f81fff2399b3277b6b9_darkgate_elex_glassworm_remcos_stop.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}	2026-07-24_5a8c08d7c4d12f81fff2399b3277b6b9_darkgate_elex_glassworm_remcos_stop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\ = "IDMan"	2026-07-24_5a8c08d7c4d12f81fff2399b3277b6b9_darkgate_elex_glassworm_remcos_stop.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	2026-07-24_5a8c08d7c4d12f81fff2399b3277b6b9_darkgate_elex_glassworm_remcos_stop.exe
Key created	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\WOW6432Node\CLSID\{07999AC3-058B-40BF-984F-69EB1E554CA7}	2026-07-24_5a8c08d7c4d12f81fff2399b3277b6b9_darkgate_elex_glassworm_remcos_stop.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1014449518-1831897916-4205727055-1000\{9A430D67-2C38-4394-A77A-42634058E58B}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
6532	msedge.exe
6532	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
7160	msedge.exe
7160	msedge.exe
7160	msedge.exe
7160	msedge.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeRestorePrivilege	4924	2026-07-24_5a8c08d7c4d12f81fff2399b3277b6b9_darkgate_elex_glassworm_remcos_stop.exe
Token: SeDebugPrivilege	3200	firefox.exe
Token: SeDebugPrivilege	3200	firefox.exe
Token: SeDebugPrivilege	3200	firefox.exe
Token: SeDebugPrivilege	3200	firefox.exe
Token: SeDebugPrivilege	3200	firefox.exe

Suspicious use of FindShellTrayWindow 8 IoCs

pid	Process
3200	firefox.exe
3200	firefox.exe
3200	firefox.exe
3200	firefox.exe
3200	firefox.exe
3200	firefox.exe
4924	2026-07-24_5a8c08d7c4d12f81fff2399b3277b6b9_darkgate_elex_glassworm_remcos_stop.exe
7160	msedge.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
4924	2026-07-24_5a8c08d7c4d12f81fff2399b3277b6b9_darkgate_elex_glassworm_remcos_stop.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
4924	2026-07-24_5a8c08d7c4d12f81fff2399b3277b6b9_darkgate_elex_glassworm_remcos_stop.exe
4924	2026-07-24_5a8c08d7c4d12f81fff2399b3277b6b9_darkgate_elex_glassworm_remcos_stop.exe
4924	2026-07-24_5a8c08d7c4d12f81fff2399b3277b6b9_darkgate_elex_glassworm_remcos_stop.exe
3200	firefox.exe
4924	2026-07-24_5a8c08d7c4d12f81fff2399b3277b6b9_darkgate_elex_glassworm_remcos_stop.exe
4924	2026-07-24_5a8c08d7c4d12f81fff2399b3277b6b9_darkgate_elex_glassworm_remcos_stop.exe
4924	2026-07-24_5a8c08d7c4d12f81fff2399b3277b6b9_darkgate_elex_glassworm_remcos_stop.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4924 wrote to memory of 3724	4924	2026-07-24_5a8c08d7c4d12f81fff2399b3277b6b9_darkgate_elex_glassworm_remcos_stop.exe	90
PID 4924 wrote to memory of 3576	4924	2026-07-24_5a8c08d7c4d12f81fff2399b3277b6b9_darkgate_elex_glassworm_remcos_stop.exe	91
PID 3576 wrote to memory of 3200	3576	firefox.exe	92
PID 3576 wrote to memory of 3200	3576	firefox.exe	92
PID 3200 wrote to memory of 3404	3200	firefox.exe	93
PID 3200 wrote to memory of 3404	3200	firefox.exe	93
PID 3200 wrote to memory of 3404	3200	firefox.exe	93
PID 3200 wrote to memory of 7144	3200	firefox.exe	94
PID 3200 wrote to memory of 7144	3200	firefox.exe	94
PID 3200 wrote to memory of 7144	3200	firefox.exe	94
PID 3200 wrote to memory of 7144	3200	firefox.exe	94
PID 3200 wrote to memory of 2688	3200	firefox.exe	95
PID 3200 wrote to memory of 2688	3200	firefox.exe	95
PID 3200 wrote to memory of 2688	3200	firefox.exe	95
PID 3200 wrote to memory of 2688	3200	firefox.exe	95
PID 3200 wrote to memory of 1244	3200	firefox.exe	96
PID 3200 wrote to memory of 1244	3200	firefox.exe	96
PID 3200 wrote to memory of 1244	3200	firefox.exe	96
PID 3200 wrote to memory of 3352	3200	firefox.exe	97
PID 3200 wrote to memory of 3352	3200	firefox.exe	97
PID 3200 wrote to memory of 3352	3200	firefox.exe	97
PID 3200 wrote to memory of 3352	3200	firefox.exe	97
PID 3200 wrote to memory of 1356	3200	firefox.exe	98
PID 3200 wrote to memory of 1356	3200	firefox.exe	98
PID 3200 wrote to memory of 1356	3200	firefox.exe	98
PID 3200 wrote to memory of 1356	3200	firefox.exe	98
PID 3200 wrote to memory of 1072	3200	firefox.exe	99
PID 3200 wrote to memory of 1072	3200	firefox.exe	99
PID 3200 wrote to memory of 1072	3200	firefox.exe	99
PID 3200 wrote to memory of 1072	3200	firefox.exe	99
PID 3200 wrote to memory of 2000	3200	firefox.exe	100
PID 3200 wrote to memory of 2000	3200	firefox.exe	100
PID 3200 wrote to memory of 2000	3200	firefox.exe	100
PID 3200 wrote to memory of 2000	3200	firefox.exe	100
PID 3200 wrote to memory of 5044	3200	firefox.exe	101
PID 3200 wrote to memory of 5044	3200	firefox.exe	101
PID 3200 wrote to memory of 5044	3200	firefox.exe	101
PID 3200 wrote to memory of 5044	3200	firefox.exe	101
PID 4924 wrote to memory of 7160	4924	2026-07-24_5a8c08d7c4d12f81fff2399b3277b6b9_darkgate_elex_glassworm_remcos_stop.exe	103
PID 7160 wrote to memory of 7080	7160	msedge.exe	104
PID 7160 wrote to memory of 6200	7160	msedge.exe	105
PID 7160 wrote to memory of 4592	7160	msedge.exe	107
PID 7160 wrote to memory of 6200	7160	msedge.exe	105
PID 7160 wrote to memory of 6200	7160	msedge.exe	105
PID 7160 wrote to memory of 1268	7160	msedge.exe	108
PID 7160 wrote to memory of 1268	7160	msedge.exe	108
PID 7160 wrote to memory of 5864	7160	msedge.exe	109
PID 7160 wrote to memory of 3784	7160	msedge.exe	110
PID 7160 wrote to memory of 5864	7160	msedge.exe	109
PID 7160 wrote to memory of 5864	7160	msedge.exe	109
PID 7160 wrote to memory of 3784	7160	msedge.exe	110
PID 7160 wrote to memory of 3784	7160	msedge.exe	110
PID 7160 wrote to memory of 1824	7160	msedge.exe	112
PID 7160 wrote to memory of 1824	7160	msedge.exe	112
PID 7160 wrote to memory of 1824	7160	msedge.exe	112
PID 7160 wrote to memory of 2492	7160	msedge.exe	113
PID 7160 wrote to memory of 4644	7160	msedge.exe	114
PID 7160 wrote to memory of 2492	7160	msedge.exe	113
PID 7160 wrote to memory of 4644	7160	msedge.exe	114
PID 7160 wrote to memory of 6768	7160	msedge.exe	116
PID 3200 wrote to memory of 2568	3200	firefox.exe	120
PID 3200 wrote to memory of 2568	3200	firefox.exe	120
PID 3200 wrote to memory of 2568	3200	firefox.exe	120
PID 3200 wrote to memory of 2568	3200	firefox.exe	120

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-07-24_5a8c08d7c4d12f81fff2399b3277b6b9_darkgate_elex_glassworm_remcos_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-24_5a8c08d7c4d12f81fff2399b3277b6b9_darkgate_elex_glassworm_remcos_stop.exe"
1⤵
- Adds Run key to start application
- Installs/modifies Browser Helper Object
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4924
- C:\Windows\system32\regsvr32.exe
  C:\Windows\Sysnative\regsvr32.exe /s "C:\Users\Admin\AppData\Local\Temp\IDMShellExt64.dll"
  2⤵
  PID:3724
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.internetdownloadmanager.com/support/installffextfrommozillasite.html
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3576
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.internetdownloadmanager.com/support/installffextfrommozillasite.html
    3⤵
    - Checks processor information in registry
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3200
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1960 -prefsLen 27098 -prefMapHandle 1964 -prefMapSize 270279 -ipcHandle 1760 -initialChannelId {9b3ff816-416a-4207-9834-eddfe65c0c1e} -parentPid 3200 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3200" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
      4⤵
      PID:3404
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2420 -prefsLen 27134 -prefMapHandle 2424 -prefMapSize 270279 -ipcHandle 2436 -initialChannelId {059ee40e-398e-4eab-ab38-f5802a509b9f} -parentPid 3200 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3200" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
      4⤵
      PID:7144
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3852 -prefsLen 25164 -prefMapHandle 3856 -prefMapSize 270279 -jsInitHandle 3860 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3868 -initialChannelId {3a8e832c-7ed6-4530-807b-3fa6bb308ffe} -parentPid 3200 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3200" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
      4⤵
      Checks processor information in registry
      PID:2688
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4036 -prefsLen 27274 -prefMapHandle 4040 -prefMapSize 270279 -ipcHandle 4132 -initialChannelId {3fca0685-f448-4223-8b08-3306d4bff7a3} -parentPid 3200 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3200" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
      4⤵
      PID:1244
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2792 -prefsLen 34773 -prefMapHandle 2864 -prefMapSize 270279 -jsInitHandle 2868 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2956 -initialChannelId {f03ce2a2-e9d7-4dfa-b234-4ab0be4ddff7} -parentPid 3200 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3200" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
      4⤵
      Checks processor information in registry
      PID:3352
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 5068 -prefsLen 35010 -prefMapHandle 5072 -prefMapSize 270279 -ipcHandle 5080 -initialChannelId {17027af2-0994-4a54-9491-6ae4a1fef8a1} -parentPid 3200 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3200" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
      4⤵
      Checks processor information in registry
      PID:1356
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5320 -prefsLen 32900 -prefMapHandle 5324 -prefMapSize 270279 -jsInitHandle 5328 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5332 -initialChannelId {d7d6078d-5ac4-4eb0-bd68-3ba9739a612f} -parentPid 3200 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3200" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
      4⤵
      Checks processor information in registry
      PID:1072
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5372 -prefsLen 32900 -prefMapHandle 5376 -prefMapSize 270279 -jsInitHandle 5380 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5384 -initialChannelId {e8325798-476d-4bb4-9609-88c35df32b41} -parentPid 3200 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3200" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
      4⤵
      Checks processor information in registry
      PID:2000
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5708 -prefsLen 32952 -prefMapHandle 5712 -prefMapSize 270279 -jsInitHandle 5716 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5724 -initialChannelId {1598239d-e696-4962-90d0-4b167c439cb1} -parentPid 3200 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3200" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
      4⤵
      Checks processor information in registry
      PID:5044
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4908 -prefsLen 32952 -prefMapHandle 3888 -prefMapSize 270279 -jsInitHandle 4252 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4004 -initialChannelId {f9464a8a-ad1e-4462-b05a-6248b90a3a79} -parentPid 3200 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3200" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
      4⤵
      Checks processor information in registry
      PID:2568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" http://www.internetdownloadmanager.com/download2.html
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:7160
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f4,0x2f8,0x2fc,0x2f0,0x31c,0x7ffe333ec188,0x7ffe333ec194,0x7ffe333ec1a0
    3⤵
    PID:7080
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1640,i,4717642073085115201,17450040651360322571,262144 --field-trial-handle=2288,i,14319633840165543227,8702698893274883325,262144 --variations-seed-version --mojo-platform-channel-handle=2280 /prefetch:2
    3⤵
    PID:6200
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1940,i,14806931278903555066,40047058777150605,524288 --field-trial-handle=2288,i,14319633840165543227,8702698893274883325,262144 --variations-seed-version --mojo-platform-channel-handle=2324 /prefetch:11
    3⤵
    - System Time Discovery
    PID:4592
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2520,i,14179950042699919366,2084023685830661326,524288 --field-trial-handle=2288,i,14319633840165543227,8702698893274883325,262144 --variations-seed-version --mojo-platform-channel-handle=3324 /prefetch:13
    3⤵
    PID:1268
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3552,i,16547545972711038495,18166747994848266060,2097152 --field-trial-handle=2288,i,14319633840165543227,8702698893274883325,262144 --variations-seed-version --mojo-platform-channel-handle=3620 /prefetch:1
    3⤵
    PID:5864
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3560,i,10839717811866733481,9987025197207245136,2097152 --field-trial-handle=2288,i,14319633840165543227,8702698893274883325,262144 --variations-seed-version --mojo-platform-channel-handle=3624 /prefetch:1
    3⤵
    PID:3784
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4908,i,9355701485815065142,3055813875196844818,2097152 --field-trial-handle=2288,i,14319633840165543227,8702698893274883325,262144 --variations-seed-version --mojo-platform-channel-handle=4996 /prefetch:1
    3⤵
    PID:1824
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3684,i,6833111603899040678,6026559449847223866,524288 --field-trial-handle=2288,i,14319633840165543227,8702698893274883325,262144 --variations-seed-version --mojo-platform-channel-handle=3700 /prefetch:14
    3⤵
    PID:2492
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3832,i,15671381606600616304,18369321145225502521,524288 --field-trial-handle=2288,i,14319633840165543227,8702698893274883325,262144 --variations-seed-version --mojo-platform-channel-handle=5148 /prefetch:14
    3⤵
    PID:4644
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5816,i,3030941302673551286,12425595418268833901,524288 --field-trial-handle=2288,i,14319633840165543227,8702698893274883325,262144 --variations-seed-version --mojo-platform-channel-handle=5832 /prefetch:14
    3⤵
    PID:1756
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5816,i,3030941302673551286,12425595418268833901,524288 --field-trial-handle=2288,i,14319633840165543227,8702698893274883325,262144 --variations-seed-version --mojo-platform-channel-handle=5832 /prefetch:14
    3⤵
    PID:6768
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5832,i,11990993888896524197,11503878961503325097,524288 --field-trial-handle=2288,i,14319633840165543227,8702698893274883325,262144 --variations-seed-version --mojo-platform-channel-handle=5912 /prefetch:14
    3⤵
    PID:4368
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5828,i,17875609287518379369,7552054052199162692,524288 --field-trial-handle=2288,i,14319633840165543227,8702698893274883325,262144 --variations-seed-version --mojo-platform-channel-handle=6432 /prefetch:14
    3⤵
    PID:1428
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6428,i,2188512977010355243,4761886184306864204,524288 --field-trial-handle=2288,i,14319633840165543227,8702698893274883325,262144 --variations-seed-version --mojo-platform-channel-handle=6336 /prefetch:14
    3⤵
    PID:1176
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5332,i,16655971337818650831,2379235586076028476,524288 --field-trial-handle=2288,i,14319633840165543227,8702698893274883325,262144 --variations-seed-version --mojo-platform-channel-handle=5308 /prefetch:14
    3⤵
    PID:5136
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5940,i,15006481991281505834,17072023917564736446,524288 --field-trial-handle=2288,i,14319633840165543227,8702698893274883325,262144 --variations-seed-version --mojo-platform-channel-handle=5408 /prefetch:14
    3⤵
    PID:1384
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5396,i,9434883329745645075,17235029119600063522,524288 --field-trial-handle=2288,i,14319633840165543227,8702698893274883325,262144 --variations-seed-version --mojo-platform-channel-handle=5444 /prefetch:14
    3⤵
    PID:7088
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5392,i,7880971270282392060,8893093804190182896,262144 --field-trial-handle=2288,i,14319633840165543227,8702698893274883325,262144 --variations-seed-version --mojo-platform-channel-handle=5948 /prefetch:10
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:6532

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4820

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:2860

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5724

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Browser Extensions

T1176

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ba1406dd0117e6bb02a18e1f0ca40a20fdf33f68d611dcf6b59a242ae289374a
MD5 8a26ea5cde92773cb558eb116e113216
SHA1 2f807e9fd5e13c4ff550fceca7d90f11683ae33e
SHA512 dca9db1a71d0ad99193f78ee9f9221519b875eb1beb13ebfbd9d64a1b449eb8a027a5b2ceadf9158001b4548f036b26ed4f2c36ce3e8b981af5a54590c0e94a5
TLSH
T1B8D0C030B7286803D5141931D022CB007A17002321BBD1025160C00C2C3BCB163CA141
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 49c46cadb35c7253392b77b7b5bcbe1506f66877d4fadedb77bf7c90f98dd635
MD5 4e03db8b730b35088e1138ed6bdd43f2
SHA1 8917e3da7c8299d9118e5f112c48ecb3f546a23b
SHA512 786c2dffae2c3f1a20b161712f881602553f047a2928e9142c662e58037bcb222f809398acfb6a24bd3aad48e094ef299a187e3b41ac57e7c1c609dca50c9a83
TLSH
T1ECF0A9A6D921AC3719FC1B2871954A4BE750135B3B41984F3B3D921D8FB463B8B46C1C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 d3b2d6f22a056300c1e506e9daccf9a4389e93f6a18c4d449164e13252d8e491
MD5 6aab459050c00eecae8fc184d9cd12c8
SHA1 74cbd5dd40792d41c277bb46d5c4f8318b1b9bd7
SHA512 43ca30d25acd2c24ad76d721e0a68495d87b4341929830d91fa7a6ac477a217230e9e29119bcdaa7ce50f0a29440e3271f6ab8b470808798c60527b59aecf729
TLSH
T110614B9D4B992BE3F72198F290E5448F36F494E9260BBE5D03417EFC9806F1920E18E7
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 d1f14c953db1ada739187625b263d482f5c025722d3a82b4933eaab27857bc63
MD5 93c72ae8f53c137dd64d6fc3e7f107d6
SHA1 fff9af4845708d9348568339cfdec89989a04619
SHA512 15659c514045b6ee3b6b89e03e85415d88647a777ae316a620a6e11dd51678c10702e36bd8e163aca350bb7bb9e844b1fd0eec19e59bdec390bf7380c408a77c
TLSH
T1E5615C9D4B992BE3F72198F254E5448F3AF094E9260BBE1D43417EFC9806F1920E18E7
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 660d5a3f1e0b17e8c328407f8ea8bea937d2611730c44732792e0af484341ecf
MD5 3bf102334821bf9289a05e6f3494ba8a
SHA1 777af4526780d0430882cc51ed84be22a2b3e9a1
SHA512 123ac116c5e3acbb1c8cf48f35b957af1c703f06bb46b2d09662e1f7569c0fd899374ff0a5416053e4303a0b0158d0fdb693e0a28a3eea4f9b9fa3e283cd97de
TLSH
T11C51CFF7C3F4856DCA1195F0AA187E1BCE2D0914832C7D9AC9E0AE1BA3E3471E141A5F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 113407271928b87e4ec0ca050cd194a66ed88385c28ba4574a776e660720280a
MD5 221d55ce80d6a43b716efabacf18aef8
SHA1 cc03ce62591e73d3934fe7e187355056f135dd2c
SHA512 a5419f1060e9491f4e0d495a93415444ff679f803c8c4d6b196b1e1717cb59a4aecc7007c0e21c4a87dff9d709629d054561a710da4cc3ae22ec63ee96097bc9
SSDEEP 384:sxRvX8U/fns6iN/RIlGB/5T/WjfsGQEj5:s7sU/fPAWm/5rWjfsGQ8
TLSH
T1F572EA16AA349D7B8CDFD209FA55BF93D2F9116391905E44AAFC8B0C04E76ED620381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 c18d5de947ea3280b6ae1edacc345dbbf4f7960480d3972350a40cf6234bf9f5
MD5 b651419624a950ed2880d6c0991782d8
SHA1 9e6c6e119afb67c5b40d9abdb2b081e4b8a5f845
SHA512 a0314ab4d2295e444700cb3256fa65183c44e3069cf0d8fabfa367b297bec9e94dd6911fc42da29395f6cb69b74ec86282bda9bb38e1317aba27dfddba978f95
SSDEEP 768:Ob4YZx7pLuL7yTWg1NfwB8F1+UoAYDCx9Tuqh0VfUC9xbog/OVEobbDwzro24u:Ob4YZnE7yTWg1NfwBu1jajobHwARu
TLSH
T170E2EB3B280CCB7E4F804ADDEC29BD9A6DA8018F5AD8C95447FA450C03C6BEB551A5DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 db9af5bf0a3a91d29f71a36729f33eeef2375a3f6a75cacb96584eaba0abd63e
MD5 2a71e1326908edf93e7930c5ad8a0ed9
SHA1 43b62941a0424906c02043303925e42e60412b6b
SHA512 96f2691e887d41f6a1155b0fd089f27ca6f45891d5141073ace49d86089d1bca252f2cb4938e4a8aa05f35d49bbba9f12f6d63f4b90dc3964cc023abba75d2e5
SSDEEP 384:yv+Rp0nYrnhZZuJCXHnbB1S/HqlcDDRPbIhJ9R39:yv+Rp0nYrnhZZuJCXHnbB1S/HqlcDDRW
TLSH
T1A3B26F11713F4290387EA90C91B8981F86C2B4637519F53F7B6802A65F67E138DFE8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 f7a1403d0bb3d1784018a937c3891aa68f43024b41f86a2cd7008a21e00ec6c2
MD5 48878b24b515a0118d2a55fb28220822
SHA1 0c5221e942f5ea5259c8f6834a3c9bc5416eeee8
SHA512 2185c85a52ca62c166893e87912001ad4593bea6eaef0d98a6fb77e6f4fc0165daf7f1704288f7fcbe1789ff2dc2f674260fb2b344aa77aa77c45ef8fe570bb8
SSDEEP 384:nNiFiZcI58NL08TUNTUlIRlPvuTyHKEqfbYGTQR9XQjWELGk4OObjI9G6w7VH8LZ:EFQ5Q0wgbuCNGUIWELP429MVI
TLSH
T1BCD26C36EC64CEB3ECEA4F95B6497656DEE411A3C59C8AC8E6D85E0C00871DE470BC17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 4499d80099ad79ffbe43a6a172c240bb934fe521c6f78b72557ea5adf260923b
MD5 35d2d0ca13a0a6f306283d8720871e9a
SHA1 05190c6b2736210da08f6d6908afd76eda8c8852
SHA512 39a359691c0be344602a54691b63553688abe5cf8c3dfaa93849d90ff9473f49ac861c7f027de3bc71a036daf98a1fe48b1fe98789cb84f3eb8bb39fd80a52c1
SSDEEP 384:nCiF1tNn/s3n9Sn8Ngs8TUNTUlIRiPvuTurREqfbYGTQR9XQpLPOObjI9G6w7ia6:JF1j+9SXswgUuWUGUaP29Mi
TLSH
T1A0C25A36EC59CEB7ECE64FD8B34A7A5ADEE012A385D85AC8DAD85E0C00C719D4307C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 72dcd9f84edd5575d1504000fbbdc29da9734970ec137c30a055d346a3ef8000
MD5 b73a091305229f3c7bb86f02695cfb2f
SHA1 3d94c45bd4257f96368e2ae477f9859650c3c69b
SHA512 71f6c3cbbc0412344aaaa24b98f73dd74cc6ca09676192043a79862586663fabd3808ab07b12f49ff02200890511e883b6f8ecab5b1f76083572e980545f1c7f
SSDEEP 384:nXiFiZcIg8NL08TUNTUlIRlPvuTy/KEqfbYGTQR9XQjWELgE4OObjI9G6w7VH8LZ:SFQgQ0wgbuCNGUIWEL9429MVI
TLSH
T1DCE2C2F698D78972E89E4B97637D6E469EFCD163B5888984B3C44D0CCC821BFC706806
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 5c08b644b70afdec09128144b1befad26b0e9a7abc960437bda1a9a46d454791
MD5 b9a9bbeb7743064bc718a7d76b1d728e
SHA1 3cdab517915484635e2c21c3f040e92965ef83e0
SHA512 5fad7dc3125abf68367750ee6b9c9d12d07b2aaa5cfa8a600f272b6e1774d0e51f0e6cb4e4c8f3b68418f6f74b805ef1634960bd9d4da288988534207628b930
SSDEEP 384:nkiFiZcI58NL08TUNTUlIRlPvuTyHKEqfbYGTQR9XQjWELGk4OObjI9G6w7VH8LZ:/FQ5Q0wgbuCNGUIWELP429MVI
TLSH
T16AD25C36EC64CEB3ECEA4F95B6497656DEE411A3C59C8AC8E6D85E0C00871DE470BC1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 0484cb616c7678b6da0981e49980e1737f37254524067edd19d7c038e8e5cc5e
MD5 f8b273cb599e11191a349360643db954
SHA1 635c0a9df5c48689773edf45428f43b341894e0c
SHA512 ca2f8d827cc6defee667d936c6a763a5e328f848bea9570da0ef7cea33c29335971ac76748b784aebbefe95d6a2ae6cc5e2374850dc1280b068a32e035fb7c97
TLSH
T1EF4130E04C382AD1D4BD0E7EB48B38FC91E8C725F490347D6858EA9859BA25D258083F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 d54dfdf3d79784a23a343d39eb0fdea824cca82a21de0508a9d4cc34165fd54c
MD5 9dcebc0c3173b5818c30e85bd193c36c
SHA1 00696d45ef8bffaa7136a2b91980a1f940a07ea6
SHA512 2eeaf5011474df9006853dfcb1c89819cee08ff97e02c7a98a2552c5757879b6630aa158f0e83bf62af18d2bacdc1f60153c5b8d98106dd6ec310091f18ff889
TLSH
T1184132E08C382AD2D4BD0A7E748B34FCD5E8C725F490343D6858EE98597A65D658083F
MD5 SHA1 SHA512 TLSH

Submit Download

4E3D8FAAF804AAC616BC48BD4AFA8BE284516FCF

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\n6eagavx.default-release\cache2\entries\4E3D8FAAF804AAC616BC48BD4AFA8BE284516FCF
Size 15KB
SHA256 ae91419630afa9d1df0c9a2a8aad781857625b0b78e64c5a886449c9002368ef
MD5 272d65dbb140f2cf194dff11d18bfb23
SHA1 25a30c536d1c1eafd2e9147b0c4042ed94cbfaea
SHA512 b85d7e3395cf67dafaa40e12fc46af180ee55c9dd3fb06fac8e8a0caf7da2f74c55f5c6d1170d09ddd731a9631fa42e6973fd15f99d9f8357a24246ba5cbc0a4
SSDEEP 384:HwCe7iO024YZfdcs3hk2nhfdDE2Ba/rIVy8emT+6T+b:QqZYBdv3hk2nhfS2sDIVy8X+o+b
TLSH
T15B728DBBCF517C5D19179989C8AD5369DC05F9ABCFF6D0A608203449C784326B0FA48F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 11KB
SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
MD5 25e8156b7f7ca8dad999ee2b93a32b71
SHA1 db587e9e9559b433cee57435cb97a83963659430
SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
TLSH
T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 502KB
SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
MD5 e690f995973164fe425f76589b1be2d9
SHA1 e947c4dad203aab37a003194dddc7980c74fa712
SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
TLSH
T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

compatibility.ini

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6eagavx.default-release\compatibility.ini
Size 198B
SHA256 252b7fff962848c61092e82a3d87adca163849767713a93ab533bb397f1f53bb
MD5 ce9ef13caa8a74c25157b184aa038475
SHA1 db03a9935d8bb3ce6b120aca98feade536805160
SHA512 0f6f5053e78167ef5cc5fa70ed3a87dd116df0671a590299277a197341bed983e3d77e37ad2c33cd4afe880fab9ed1c7f7502210040617a01f97a81c1e1d4f29
TLSH
T1C1D022818BC7848C9D4AA8E4537C38086BF2EE0E0604492A32827F0B4164F09023C3F9
MD5 SHA1 SHA512 TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6eagavx.default-release\datareporting\glean\db\data.safe.tmp
Size 26KB
SHA256 05cba6daa7f84041e896bb5693c3b99bef391e9e3f31a3b644e42b1f0eb99bab
MD5 71dc007beadfd0cb8d213c061f7f757d
SHA1 a9f918532e9d255cc735aa4968fe94c70c7c288b
SHA512 c47fdac37ce161e73b4824104e53a02fe80e3b2bc966bb4893be4097d3336457e644a1c8941a2ae48134c5fe8d9fd24024ba1202cd2f773262f11999e939ff9a
SSDEEP 768:bJlLzZpx4Gcm+uFwVROqJD2Cb2b4bTbzRcD1y:bJlLzZvzwV7h
TLSH
T1C4C22184FB2E953FD42552BADCA50B002F79B8CA58092F573A4D64682C872DC3D9E07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6eagavx.default-release\datareporting\glean\db\data.safe.tmp
Size 26KB
SHA256 0e3996bf7a4aba0b9e6b56e76c51ad0c5a7573610606b7673559ab81d70c2225
MD5 c156f28e443eca9e0103d4604ef8584b
SHA1 45e6f002a69ed1423100cc6b9d5dd68aef4b5d38
SHA512 d01371ada644063b0f8c71cf15478fe1e20bc039cd43e8d731b0fb98fda7d257436a831b6a4b3768660d4c5dbf843df587f1f511076a8973eea063f6c85074ee
SSDEEP 768:bJlLzZpx4Gcm+uFwVROqJD2Cb2b4bTbz2Tp1/:bJlLzZvzwV7k
TLSH
T1D2C20044FB2A953FD42552BBDCA51B001F79B8CA98092F573A4D64682C872DC3E9E07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6eagavx.default-release\datareporting\glean\db\data.safe.tmp
Size 27KB
SHA256 863a185bf9c4e77caf9a9f6a15351f0ef55cb4d1aad9fed1af3696b227fe49ac
MD5 5d0e471e8e2664bfcd9bb1d3fdf34807
SHA1 1acfec4196d7a2c92f037dcdb4c980cc9274757c
SHA512 9d757e5f44afb6be737e09cadf96563e8be3f634f19784b2a451eb1a046e7f34f4af3bb5fceef80fb747bead9e22f6be49b1fdd895cb258ce8c5a311c1f6cf21
SSDEEP 768:bJlLzZpx4Gcm+uFwVROqJD2Cb2b4bTbzO1LkF:bJlLzZvzwV79
TLSH
T13DC20044FB2A953FD42552BBDCA51B001F79B8CA58092F573A4D64682C872DC3D9E07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6eagavx.default-release\datareporting\glean\events\events
Size 1KB
SHA256 20349a8c2f584285ee1d1927acc6becc5b2fc299f7222b5b6f26e71f90ba2dbc
MD5 1159f5ce1ac2861959c8464cbf272130
SHA1 1379a5aa710df00638584c72a78aa8c02c608c9d
SHA512 092383082e12ec83582608ecb42442b7f0626e6634e4b3722d36a9e83bf8348fdfaf3756c8fbbad37d29f47d4648c1575abbd12400c179f06deb4eea26bfac75
TLSH
T11D11575C7EB94D6AAA87E3987440228E53168E4A44872D435D22FE8DCEC1ED9322D838
MD5 SHA1 SHA512 TLSH

Submit Download

091a1fb9-a474-4d08-bb3e-b3c5b00dffa7

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6eagavx.default-release\datareporting\glean\pending_pings\091a1fb9-a474-4d08-bb3e-b3c5b00dffa7
Size 235B
SHA256 49ed6444b6f089bf3e94eb56e65a0d8c89a936f7331648d1539d979d351a9485
MD5 a2fdd0eb70c6c6e4ca7f99b7859ed2d2
SHA1 2a5141574c985a75578fb9d25cf0e7fe158d7403
SHA512 f4197b6e0de58152286a1032241ad3ce9e910657b8d895a513c36e29176967011e855c844a56124c5051b8c82e9f2935b134c39651eb42d4323dc2ba4ef40ad5
TLSH
T1B2D0A78978D8776D08141F1AF1A16BC670584C3314695890D7928678EAF9DC84252D6B
MD5 SHA1 SHA512 TLSH

Submit Download

9c6af489-7e2e-41be-807c-4773bdb8cf05

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6eagavx.default-release\datareporting\glean\pending_pings\9c6af489-7e2e-41be-807c-4773bdb8cf05
Size 235B
SHA256 240a1cd9930cd3028f7a70b5509e163ce5b8782a881f805a13e802e497bb4ea3
MD5 a7039cbf6e5a314006f4ceba0df84d87
SHA1 7debd3fcdfa8fd35ff7128bd659d91708345174a
SHA512 f0efbfe043051c2c99fef39172d2fd4f3748e93c6c7de518b49e4beefea13ca3c5f16055c8300642b7246b6ce0139eedd40753551190f142caf7c6fa5d5b995a
TLSH
T18CD09780388877AC08045F0BB6A13AC630448C33186498249A710538CABA9C40156867
MD5 SHA1 SHA512 TLSH

Submit Download

b41ff64f-a6d9-4844-8722-46de750731ba

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6eagavx.default-release\datareporting\glean\pending_pings\b41ff64f-a6d9-4844-8722-46de750731ba
Size 886B
SHA256 e617feb46c1e9dca592e191f82047b3c0d6278bb02d6ce1f2680c8b7a79963a3
MD5 2cd2f62dfebb72eae1f81bb2c5ccaf80
SHA1 b946109e560eaf9bd39d0f036b23104ca18e6b7c
SHA512 055a506b01c311ca918c113edefd3cda8c86d2fe8c7cbcf999d3aec8481c13176310562514ae4a6abef74894252ac19bfa0c67d77f41bad4b5e0eeaeac4315ca
TLSH
T1B01100418674B9728D3CE35B85917B474AE47423C0C649143D919B180EAE22FA7AA60B
MD5 SHA1 SHA512 TLSH

Submit Download

bee32e3f-5e67-42b3-849d-b6324f768b9b

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6eagavx.default-release\datareporting\glean\pending_pings\bee32e3f-5e67-42b3-849d-b6324f768b9b
Size 871B
SHA256 4c6cef334541277699b827dad15e8af19eef104824bb9b6b35dfbd576cb5f8ba
MD5 c39bff1965d2be46a8c47478ccdc9e78
SHA1 14b616ea4e77a9602b30bcf46d3137c9a4fc7788
SHA512 f9534cf4fe005bb8ae4cb63ebfff67648ff843a6b3c0c845e7436620eeed2eba02bee83f259633320feed743e0f92d345222d7de0e82b14c093c14eab825586c
TLSH
T15711EF41A634B976CD3CD34B859A3B428BE4742384CA54143DE18F1C0E7E21BEBAA64B
MD5 SHA1 SHA512 TLSH

Submit Download

deeb08b2-386f-437f-9292-d6178a583f14

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6eagavx.default-release\datareporting\glean\pending_pings\deeb08b2-386f-437f-9292-d6178a583f14
Size 2KB
SHA256 456c86ac883fcb3667c50dab81f9d0434776137da510a8d06ce51c0f57e0eefb
MD5 1d186dc9b873ac2b6c04eb1c36460360
SHA1 195e72a50a798aeede3aab972fae8b85089449ad
SHA512 3d3b8999fb440e2b15b4a53f34c35ec152d8a44f940cbfaca9152fae255175a9dd41148cd721e4010a5a5f07ad352647a8c1ab6e57cc3c142ba63355f250da61
TLSH
T1C541555D357C4C765CDEE24D904633CE5374890304C618433E82DF0C8DE265E636A51F
MD5 SHA1 SHA512 TLSH

Submit Download

extensions.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6eagavx.default-release\extensions.json
Size 16KB
SHA256 cd7fd638436c1a8703b0dd9649c81dec64c946c1f4c16c67aa128b5dfa2c4347
MD5 51d1138146f4fe668d8a7978067bbd4d
SHA1 c8920dc215be2e573482dcbbfcaaee64edddb168
SHA512 8e690fbff78e826ddb7f0d6fa82ffaf473749c86a9feb9a68d78cb44fee7257a7fed8f6f8588e9a4c1bcff37e0b84fdef25e1ed8f846ab51fa9febc0a45894c4
SSDEEP 384:GkI4voUmldvd8dhWh94zZ96oZL4HjL4PdL4HBL4HvL4H044hH:JI4wRfuXU4L6O4v4V454T4l4d
TLSH
T14772422545049EB8294FA78AAA367E01C37D573B60845C78F4DD8FC802FA5B902BB65B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6eagavx.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
Size 1.1MB
SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
MD5 626073e8dcf656ac4130e3283c51cbba
SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
TLSH
T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6eagavx.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
Size 116B
SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
MD5 ae29912407dfadf0d683982d4fb57293
SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
TLSH
T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6eagavx.default-release\gmp-widevinecdm\4.10.3050.0\manifest.json
Size 1002B
SHA256 2894996540fabbd346ed4ced8386ca77d6badf60372e307ee15c906c30340d0d
MD5 dcffff15fa618a53834ee4ae8673bd23
SHA1 87316c1f583f438b55e3b0a94783ff9dc8f177f7
SHA512 250c869c49c886306aa0362567cb1ccacae676f886a5b9206ce77fb92acf3af16bd574e80d01e0f97f031d6f00710af8f82c176df51994dcfb51153bed3cee46
TLSH
T139115B00DD388DD326D4BAA21CD6580A97661DAF5CC23E94379E161D8F1C8AB937376C
MD5 SHA1 SHA512 TLSH

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6eagavx.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll
Size 21.6MB
SHA256 f1216e26ee8c27f938d7722427d29f190e569ed83d0ba16ea872cae684b97602
MD5 d14dd3f0107ff91c3e21f301d83f82b0
SHA1 f61d7d687c9d4b3b6a6c9c0f5610025b5d3f4e45
SHA512 de745c2ff8440d72c5616a88fc56918f4aa7de202c8c4cd7fd026d5eebebde6ee97a3a8a76f331da4c03042b7d87ba8dc2eda40bb475fb47e56df5c2795cf97d
SSDEEP 393216:bYXajn9L4mghF5QDwW0LmruPCB78HYUUZBKvq9PW1gL2hoHH:emghF5QDwWCm/2YU8Ivq9u5K
TLSH
T14E37F18AF36350A8D84E9DF0426EAA72D0743C4E03359AEF17D47B315A727C06A79F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6eagavx.default-release\prefs-1.js
Size 8KB
SHA256 0361b6211dfa07f7880c3aca1244b37661d2e0ce84561a167da259aefe8b242d
MD5 3be7301854e316fa66d0587e872dbd24
SHA1 68bcb9d919b48b051770366b5f9d8b9e95192856
SHA512 5db0285bdf585d7fbb6e9bd4ccafa2e0998cd05c3c4ff7b853fdc286fe0e17cbaa9f421c11f4aa2caf7fe75198c1654f26af48bab27f9d9e72d8ec8aca12eb26
SSDEEP 96:xHKElTUPqGq1f54fObzSKSSlQdv9jUnRRWRhTyzML4MBw88HBBR+/8L4cnx3hezy:kErR1f54f0SSf8R5yzMPBw88H5++X
TLSH
T194021E3C9504CF7F65BA376CAC2449305AA2023BB6BF68D710B9A8C5054CF3441EDAEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6eagavx.default-release\prefs-1.js
Size 6KB
SHA256 396475985a49641c4e5c4cef79fd87ce7e4ef5a5b1ca6049f222b0b5c17af363
MD5 f94aefa767c2445bb63eeb2e4cdf6793
SHA1 9d0efae45d498651a0795fa219a7d0e77515bd13
SHA512 68abc6528f770d08c4ee4663fca8ec8d2ab221153e8006dfe2fa7128587dc6dfd6fa8bba840e8e99e7d72769a8b789ad3b739161df2c5ee290ba1832acb8e461
SSDEEP 96:xHKEUTUPqGq1fn4f1zSKSSlQdv9jUnRRHnyzMLEBw88u8L4cnx3hezy:kESR1fn4f3SSf9nyzM4Bw88TX
TLSH
T1C7E11F789508CF7F74B677ACAC6888316AB2413BBBBF68D610B95484050CF3441F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6eagavx.default-release\prefs.js
Size 6KB
SHA256 6700c1346f9da1991f3206f632b68423b01d5832b1a0fafda6c7cf665c9bbe03
MD5 9c5d8df5682453c4db5289e3c312691c
SHA1 7ef7aff3365c066cb14252c4b967ea00ac4c673c
SHA512 de2bee3652031ecfc63325bce603a417945417c7a10c64d08c5a9105012c0b190f55f2ff9c708b2a36659199cd1a2b181807f965f877d758aebff5de89b7a3c2
SSDEEP 96:xHKEUTUPqGq1fn5Y1zS7SSlQdv9jynRRHnyzMLEBw8828L4cnx3hezy:kESR1fn5YCSSZ9nyzM4Bw887X
TLSH
T100E10F7891088F7F74B677ACAC684C716AB2013BB7BF68D650B94485015CF3841F9AEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6eagavx.default-release\prefs.js
Size 6KB
SHA256 29a640bcea2c1714cf404cf3e14ef49a83000c73bcb5dfff1584d58d48943853
MD5 8c3cb7c02f720a2a8387ce6cd5af4a2d
SHA1 26992f24961e3ad5332f04286d9f3951538c56c8
SHA512 3ae2cc9e612f691b83578a15da89b9a2f8828bcb16b10a7cc65da7069916a7f665e0a85990e458193ddd44055c1c8fe6532712995b467d1939519a2f7ff91947
SSDEEP 96:xHKEUTUPqGq1fn4fObzSKSSlQdv9jUnRRHnyzMLEBw88u8L4cnx3hezy:kESR1fn4f0SSf9nyzM4Bw88TX
TLSH
T163E11F789508CF7F64B677ACAC6888316AB2413BBBBF68D610B55484054CF3441F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6eagavx.default-release\sessionstore-backups\recovery.baklz4
Size 1KB
SHA256 1748846e235a6141be98622a1ca9f927f8f64d865dba65cb5f1979b4cfe48801
MD5 1ca447f5d11700025671f5b72ec89453
SHA1 ae6772ceacd81f11daaa395d5e0d2512a7831ee4
SHA512 23bd142360b3240995e71c36c1e4ec8ebe6ef29ac188907ed8031399e370c54ec4ec30844522153ca52cfdc870db29f36680a60c35a447dd81721720efd9c84f
TLSH
T18321F84BA9633DF5BB93E38464856F758EA720318074C8F090DB4E4986EE449724B10E
MD5 SHA1 SHA512 TLSH

Submit Download